CVE-2026-15640: Secret Server SAML Auth Bypass Flaw

CVE-2026-15640 Overview

CVE-2026-15640 is an authentication bypass vulnerability in Delinea Secret Server. Under specific conditions, an attacker can reuse a valid Security Assertion Markup Language (SAML) Identity Provider (IdP) response to impersonate another Secret Server user. The flaw is categorized under [CWE-290]: Authentication Bypass by Spoofing. Because Secret Server functions as a privileged access management (PAM) platform, successful impersonation can expose stored secrets, credentials, and privileged sessions.

Critical Impact

A valid SAML IdP response may be replayed or manipulated to impersonate another Secret Server user, granting unauthorized access to privileged credentials.

Affected Products

• Delinea Secret Server (SAML-authenticated deployments)
• Refer to the Delinea Security Advisories for specific affected versions
• On-premises and cloud-hosted Secret Server instances configured with SAML federation

Discovery Timeline

• 2026-09-16 - CVE-2026-15640 published to the National Vulnerability Database
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-15640

Vulnerability Analysis

The vulnerability resides in how Secret Server validates SAML assertions returned by the configured Identity Provider. Under certain conditions, the application accepts a valid IdP response and binds it to a Secret Server user context that differs from the subject the assertion was originally issued for. This constitutes an authentication bypass by spoofing, mapped to [CWE-290].

Secret Server manages privileged credentials, so an attacker who impersonates another user inherits that user's vault permissions. Depending on the impersonated account, the attacker can read stored secrets, launch remote sessions, or modify access policies. The attack proceeds over the network without requiring valid credentials for the target user.

Root Cause

The root cause is insufficient validation of the binding between a SAML assertion and the Secret Server user account it authenticates. Effective SAML validation requires strict checks on the assertion's Subject, NotOnOrAfter, Audience, Recipient, InResponseTo, and signature scope. When one of these bindings is missing or improperly enforced, a legitimate assertion can be redirected to authenticate a different principal.

Attack Vector

The attack is network-based and requires no prior authentication to Secret Server. An attacker must obtain a valid SAML IdP response, for example by intercepting a legitimate authentication flow, replaying a captured assertion, or leveraging an assertion issued to an account they control. The attacker then submits that response to the Secret Server SAML consumer endpoint to establish a session as the targeted user. Attack complexity is high because specific conditions must be present for the impersonation to succeed.

No public proof-of-concept exploit is available at this time. Refer to the Delinea Security Advisories for vendor-specific technical detail.

Detection Methods for CVE-2026-15640

Indicators of Compromise

• SAML AuthnResponse messages where the assertion Subject does not match the resulting Secret Server user session
• Multiple Secret Server logins for distinct user accounts originating from the same source IP within a short window
• Secret access or session launch events for privileged accounts that do not correlate with expected user activity or IdP sign-in events
• Unexpected access to high-value secrets from unusual geographies or endpoints

Detection Strategies

• Correlate Secret Server authentication logs with IdP sign-in logs and alert on Secret Server sessions that lack a corresponding IdP authentication event for the same user
• Monitor for reuse of SAML assertion IDs (ID attribute) or duplicate InResponseTo values across sessions
• Baseline normal SAML response timing and flag assertions consumed close to or after the NotOnOrAfter boundary

Monitoring Recommendations

• Forward Secret Server audit logs and IdP authentication logs to a centralized analytics platform for correlation
• Enable verbose SAML logging on both the IdP and Secret Server to capture assertion identifiers, subjects, and timestamps
• Alert on any privileged secret retrieval that follows an anomalous or unmatched SAML authentication event

How to Mitigate CVE-2026-15640

Immediate Actions Required

• Review the Delinea Security Advisories and apply the vendor-supplied patch for Secret Server
• Audit recent SAML authentication and secret access events for evidence of impersonation
• Rotate any secrets that may have been exposed to a potentially impersonated session
• Force re-authentication of all active Secret Server sessions after patching

Patch Information

Delinea has published remediation guidance through the Delinea Security Advisories portal. Administrators should identify their Secret Server version, apply the fixed release documented in the advisory, and verify SAML configuration after the upgrade.

Workarounds

• If patching cannot be performed immediately, disable SAML authentication and fall back to a hardened local or directory-based authentication method
• Enforce short SAML assertion lifetimes and require signed responses in addition to signed assertions on the IdP
• Restrict Secret Server administrative and SAML endpoints to trusted networks using firewall or reverse-proxy access controls
• Require multi-factor authentication at the IdP for all Secret Server users, particularly privileged administrators

# Configuration example: restrict access to the Secret Server SAML endpoint
# (example nginx allowlist in front of Secret Server)
location /SecretServer/login.aspx {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass https://secretserver.internal;
}